r3689 - in branches/2.0/varnish-cache/bin: varnishd varnishtest/tests

[tfheen at projects.linpro.no]

Author: tfheen
Date: 2009-02-06 16:10:33 +0100 (Fri, 06 Feb 2009)
New Revision: 3689

Added:
   branches/2.0/varnish-cache/bin/varnishtest/tests/r00387.vtc
Modified:
   branches/2.0/varnish-cache/bin/varnishd/cache_fetch.c
Log:
Merge r3500: Fail long chunked transactions, don't panic

Don't panic if the chunked header is ridiculously long, just fail
the transaction.

Fixes #387



Modified: branches/2.0/varnish-cache/bin/varnishd/cache_fetch.c
===================================================================
--- branches/2.0/varnish-cache/bin/varnishd/cache_fetch.c	2009-02-06 15:06:50 UTC (rev 3688)
+++ branches/2.0/varnish-cache/bin/varnishd/cache_fetch.c	2009-02-06 15:10:33 UTC (rev 3689)
@@ -110,7 +110,8 @@
 
 		/* If we didn't succeed, add to buffer, try again */
 		if (q == NULL || q == buf || *q != '\n') {
-			xxxassert(be > bp);
+			if (bp >= be)
+				return (-1);
 			/*
 			 * The semantics we need here is "read until you have
 			 * received at least one character, but feel free to

Copied: branches/2.0/varnish-cache/bin/varnishtest/tests/r00387.vtc (from rev 3500, trunk/varnish-cache/bin/varnishtest/tests/r00387.vtc)
===================================================================
--- branches/2.0/varnish-cache/bin/varnishtest/tests/r00387.vtc	                        (rev 0)
+++ branches/2.0/varnish-cache/bin/varnishtest/tests/r00387.vtc	2009-02-06 15:10:33 UTC (rev 3689)
@@ -0,0 +1,22 @@
+# $Id$
+
+test "Regression test for #387: too long chunk header"
+
+server s1 {
+	rxreq
+	send "HTTP/1.1 200 Ok\r\n"
+	send "Transfer-encoding: chunked\r\n"
+	send "\r\n"
+	send "004\r\n1234\r\n"
+	send "000000000000000000001\r\n@\r\n"
+	send "00000000\r\n"
+} -start
+
+varnish v1 -vcl+backend {} -start
+
+client c1 {
+	txreq
+	rxresp
+	expect resp.status == 503
+} -run
+